performance

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/vllm-server.py uses subprocess.Popen to launch the official vLLM OpenAI-compatible API server. The command is constructed as a list using sys.executable and specific model parameters, which is a standard pattern for deployment templates and does not involve arbitrary shell execution.
  • [EXTERNAL_DOWNLOADS]: The scripts/quantization-config.py script includes functions to download calibration datasets from well-known sources like HuggingFace (allenai/c4, codeparrot/github-code). These are standard practices for LLM model quantization and align with the skill's stated purpose.
  • [SAFE]: The skill documents Core Web Vitals targets for 2026, React optimization techniques (React Compiler, virtualization, lazy loading), and LLM inference improvements (vLLM, quantization, speculative decoding). All provided code examples in the rules/ and scripts/ directories follow industry best practices for performance engineering.
  • [SAFE]: No hardcoded credentials, sensitive file path access, persistence mechanisms, or obfuscated instructions were found across the 44 files analyzed.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 12:49 AM
Security Audit — agent-trust-hub — performance